Yes. A multi-architecture tag points to an image index that references one manifest per platform, each with its own layers. The amd64 and arm64 images can contain different binaries and sometimes different packages. Scan every platform manifest and record each digest, not only the index.
How multi-arch images are built
The OCI image specification describes an image manifest as the configuration and layers for a single image for a specific architecture and operating system. An image index contains information about a set of images that can span architectures and systems, acting as a multi-architecture manifest that references the platform-specific ones. When you pull a tag, your runtime picks the manifest matching the node.
So a tag such as app:2.3 can resolve to different content on an x86 node and an Arm node.
Why findings can differ
| Cause | Effect |
|---|---|
| Architecture-specific packages | A package exists on one platform only |
| Different base image variants | Versions drift between platforms |
| Build steps that download per arch | Different binaries and versions |
| Separate build runs | One platform rebuilt, the other stale |
Most findings will match. The differences are where a surprise hides, such as an Arm image still carrying an old library after the x86 image was rebuilt.
Steps
- Resolve the index to its list of platform manifests and record each digest.
- Scan each manifest as its own image.
- Compare the package lists between platforms and investigate differences.
- Report findings per platform, with the platform in the finding name.
- Pin deployments to the platform digest or to the index digest, and be clear which. Our post on multi-arch digest pinning covers the choice.
- Rebuild all platforms together so they do not drift.
Saving and exporting by platform
docker image save has a platform option, for example linux/amd64, to export a single platform. If you request a platform that is not in the local store, the command fails. Without the option, all platforms in the store are saved. That matters if you scan from an archive: confirm which platforms the archive actually holds.
Attestations are per digest too
Signatures and SBOMs attach to a specific digest. An SBOM attached to the index does not describe each platform image. See multi-arch attestation pitfalls.
Try it yourself
Click through it at your own pace, or open it full screen.
Think of each scan as covering one platform, and picture running it again for the other.
Quick check
If the Dockerfile is the same, are the images the same?
No. Build-time downloads and base variants can differ per platform. Verify by comparing inventories.
Which digest goes in the report?
Both: the index digest for the tag and each platform manifest digest for the scan results.
Safeguard scans dependencies and SBOMs for what you ship; the free scan is a quick start.
Sources
Last reviewed: 19 October 2026.
